Ask what has to be true for you to get paid again next year. That question answers it. "Which layer is more defensible" does not, because both are defensible for different companies.
Two companies, opposite directions, same landing spot
Alation spent fourteen years building the data catalog category, rebranded around AIOS, and told customers in their own FAQ to build agents wherever they like: Claude Code, n8n, Microsoft 365. AIOS just governs the data underneath.
Glean came from the other side. Seven years as the assistant people actually open, then a Model Hub and an MCP Gateway so customers can pick their own models, clouds, frameworks, and front ends without rebuilding underneath.
One climbed up from the catalog. One stepped back from the interface. Both landed on: be the substrate.
Why the move makes sense
The interface layer is where bundling happens. Copilot ships inside a license the customer already signed, Gemini shows up in Workspace, and no independent assistant wins an argument against "it's already included."
So you move what you own somewhere the bundle cannot reach. Permissions, lineage, the org-specific context that took eighteen months of connector work to assemble. Expensive to reproduce, boring to demo, which is exactly what makes it defensible.
Why it is a hedge, not a strategy
The layer underneath is also where the incumbents already live. Microsoft has the Graph. Google has the workspace. The data was in their systems before anyone built a knowledge graph on top of it. Retreating to infrastructure only works if you are retreating toward something the incumbent cannot reach, and a lot of the time you are retreating directly into their house.
And it has a bill nobody prices in.
Glean's 45% wDAU/wMAU ratio, more than double the enterprise SaaS norm, exists because Glean owns a surface people open. It is the single most valuable thing they have, more than the ARR headline, because it is the thing that survives a budget review.
Plumbing does not have a wDAU/wMAU ratio. Nobody opens plumbing. Become the layer underneath and your relationship moves from a person with a habit to a procurement team with a spreadsheet, and the conversation stops being about whether people would miss you and starts being about your unit price versus the next vendor's. That is a fine business. It is a very different business, and it renews differently.
Both companies are hedging: Glean kept its assistant and opened the gateway, Alation kept the catalog and put governance on top. That is not decisive positioning, it is optionality, bought because nobody knows which layer commoditizes first. Rational at their scale. Copying the posture without the balance sheet is how you end up with a substrate nobody plugs into and a surface nobody opens.
The decision rule
If your renewal depends on a human choosing to come back, you are a surface. Your job is habit: return rate, time to first useful answer, whether the thing shows up where the work already happens. Openness is a feature you offer, not an identity you adopt, and every hour spent making yourself neutral is an hour not spent making yourself sticky.
If your renewal depends on a system calling you, you are a substrate. Your job is reliability, latency, permission fidelity, and the completeness of what you cover. Nobody loves you and that is the correct outcome. Your metric is call volume and breadth of integration, not delight.
If you are honestly both, you have two products with two different renewal mechanics. Pretending otherwise means one gets run as a side effect of the other, and it is usually the surface that rots, because the substrate has cleaner metrics and louder customers.
What actually stays scarce
The substrate crowd keeps pointing at the wrong asset. It is not the connectors, MCP is eating that, and Glean shipping a gateway is the tell. It is not the index, and it certainly is not the model.
What stays scarce is the permission model plus the record of who asked what and what they did with the answer. Permissions are scarce because they encode org structure no external system can re-derive. The query record is scarce because it is the only place the organization's real questions get written down, and it compounds.
Everything else is a feature someone will bundle.